无法修复Microservices体系结构中使用API网关模式时出现的veracode cwe id 918缺陷(SSRF)开发者社区

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

文章/答案/技术大牛

发布

/// <summary>
/// Gets the detail of an account by its id
/// </summary>
/// <param name="organizationId">Id of the Organization of which the account belongs to</param>
/// <param name="accountId">Id of Account of which information is being requested</param>
/// <returns>Account's Details</returns>
[HttpGet("{organizationId}/{accountId}")]
public async Task<IActionResult> GetAccountAsync(Guid organizationId, Guid accountId)
    _uri = new Uri(uriString: $"{_configurationService.AccountAPI}GetAccount/{organizationId}/{accountId}");
    using var result = await _client.GetAsync(_uri);
    var content = await result.Content.ReadAsStringAsync();
    return Ok(content.AsObject<MessageResponse<AccountDetailVM>>());
}

/// <summary>
/// Gets the detail of an account by its id
/// </summary>
/// <param name="organizationId">Id of the Organization of which the account belongs to</param>
/// <param name="accountId">Id of Account of which information is being requested</param>
/// <returns>Account's Details</returns>
[HttpGet("{organizationId}/{accountId}")]
public async Task<IActionResult> GetAccountAsync(Guid organizationId, Guid accountId)
    if (organizationId != Guid.Empty && accountId != Guid.Empty)
        string url = HttpUtility.UrlEncode($"{_configurationService.AccountAPI}GetAccount/{organizationId}/{accountId}");
        using var result = await _client.GetAsync(url);
        var content = await result.Content.ReadAsStringAsync();
        return Ok(content.AsObject<MessageResponse<AccountDetailVM>>());
    return BadRequest();
}

/// <summary>
/// Gets the detail of an account by its id
/// </summary>
/// <param name="organizationId">Id of the Organization of which the account belongs to</param>
/// <param name="accountId">Id of Account of which information is being requested</param>
/// <returns>Account's Details</returns>
[HttpGet("{organizationId}/{accountId}")]
public async Task<IActionResult> GetAccountAsync(Guid organizationId, Guid accountId)
    if (organizationId != Guid.Empty && accountId != Guid.Empty)
        var httpClient = new HttpClient();
        //Appended the parameters in base address to
        //to fix veracode flaw issue
        httpClient.BaseAddress = new Uri($"{_configurationService.AccountAPI}GetAccount/{organizationId}/{accountId}");
        //passing empty string in GetStringAsync to make sure
        //veracode doesn't treat it like modifying url 
        var content = await httpClient.GetStringAsync("");

问 无法修复Microservices体系结构中使用API网关模式时出现的veracode cwe id 918缺陷(SSRF) EN

回答 1

Stack Overflow用户